search

The-Z-Labs / linux-exploit-suggester

Linux privilege escalation auditing tool
GNU General Public License v3.0
5.54k stars 1.09k forks source link

My OS is up to date, why I still get the CVE exposure report? #100

Open GoliTech opened 1 year ago

GoliTech commented 1 year ago

After updating my OS I run the script again and it shows me some CVEs. Does this mean my OS is still vulnerable?

bcoles commented 1 year ago

After updating my OS I run the script again and it shows me some CVEs. Does this mean my OS is still vulnerable?

Unlikely but impossible to say without seeing the output.

GoliTech commented 1 year ago

image

@bcoles

GoliTech commented 1 year ago

@bcoles I just scanned the official Ubuntu docker image

bcoles commented 1 year ago

The match for nft_object UAF (CVE-2022-2586) does not set a maximum kernel version. This is likely a false positive.

https://github.com/The-Z-Labs/linux-exploit-suggester/blob/8867882040a1453cb33b3f92b530db5b0e134182/linux-exploit-suggester.sh#L947

sudo Baron Samedit and sudo Baron Samedit 2 (CVE-2021-3156) exploit a vulnerability in sudo which was patched in 2021.

The match for both of these is a simple check for the sudo package version below 1.9.5p2. This is likely a false positive; however, you should check your version of sudo (apt version sudo / sudo --version).

https://github.com/The-Z-Labs/linux-exploit-suggester/blob/8867882040a1453cb33b3f92b530db5b0e134182/linux-exploit-suggester.sh#L1501 https://github.com/The-Z-Labs/linux-exploit-suggester/blob/8867882040a1453cb33b3f92b530db5b0e134182/linux-exploit-suggester.sh#L1512